Post-quantum cryptography for Japanese financial institutions: the FSA report and how to start

What post-quantum cryptography is

Post-quantum cryptography (PQC) is cryptography for which, as far as is currently known, there is no efficient attack even when quantum computers become practical; that is the definition in the glossary of the FSA study group report. It is a different technology from quantum key distribution (QKD), which shares keys using the principles of quantum mechanics, and the Japanese government’s interim report of November 2025 also treats the two separately.

It has long been known that running Shor’s algorithm (published in 1994) on a quantum computer could break today’s public-key cryptography, but because no quantum computer could run it, this was not seen as a realistic threat. The FSA report notes that quantum computing has advanced remarkably in recent years but has not yet reached a level that poses a realistic threat to public-key cryptography. According to the government’s interim report, breaking the public-key cryptography used in communications in a realistic time would require a fault-tolerant quantum computer (FTQC) with at least one million physical qubits.

What sets public-key cryptography apart from symmetric ciphers and hash functions is that longer keys are not expected to restore adequate security. In financial institutions, public-key cryptography protects user authentication, firmware signatures, digital certificates and key exchange. The FSA report lists representative data to protect, including internet banking credentials and transaction data, authentication data in the IC chips of cash cards, internal operational data, and email and SMS, and gives examples of shared systems: the Zengin System, BOJ-NET, the integrated ATM switching service, Densai.net, CAFIS and SWIFT. Because so many institutions use the shared systems, the report expects agreeing changes to their security measures to take time.

Why now: harvest now, decrypt later and long migrations

Estimates of when a cryptographically relevant quantum computer (CRQC) will appear vary widely. The FSA report notes views ranging from around 2030 to 2050 to never. The government’s interim report cites one study estimating less than a 5% chance that a quantum computer able to break RSA-2048 will exist before 2039, and another analysis that, as of 2024, put the probability of one within 15 years at about 39% to 62%, and concludes that the timing is hard to predict accurately. Two things nonetheless make preparation urgent: harvest-now-decrypt-later attacks, and the time that migration itself takes.

Mosca’s inequality: if X + Y > Z, act

In a harvest-now-decrypt-later (HNDL) attack, encrypted data is collected and stored now and decrypted once a CRQC exists. Citing Michele Mosca, the FSA report explains that if X is the number of years needed to migrate a cryptographic system, Y the number of years the data must stay protected, and Z the number of years until a CRQC appears, then X + Y > Z means preparation against HNDL attacks is needed. For example, if migration takes 10 years and the data must be protected for 20, protection by the old cryptography has to hold for 30 years, counting data created just before the migration finishes. If a CRQC appears within those 30 years, the data is exposed to HNDL attacks.

The report gives several reasons why migration takes long: public-key cryptography is used in many places, including TLS, signatures on electronic documents, IC cards and application-specific encryption, so finding all of it takes time; many parties are involved, such as development contractors, product vendors and the owners of connected systems; and protocols and products that incorporate PQC are still being rolled out. The government’s interim report adds that schemes such as RSA took about 20 years from proposal to widespread use, so a long migration schedule needs to be drawn up and prepared for.

The NIST standards: FIPS 203, 204 and 205

The US National Institute of Standards and Technology (NIST) announced its PQC standardization plan in February 2016, evaluated dozens of candidate algorithms, and on 13 August 2024 published its first three PQC standards. The mathematician who heads NIST’s PQC standardization project urged system administrators to start integrating them into their systems immediately, adding that there is no need to wait for future standards.

A signature scheme based on Falcon, FN-DSA, is to be standardized as FIPS 206. NIST’s PQC project page, updated on 5 August 2026, describes Falcon and HQC as selected for ongoing standardization. HQC, a key-encapsulation mechanism, was selected on 11 March 2025 as a backup in case ML-KEM is broken; at the time, NIST planned to publish a draft standard in about a year and to finalise it in 2027. In Japan, according to the government’s interim report, CRYPTREC is evaluating the security and implementation performance of FIPS 203, 204 and 205 in turn, so that the results can be reflected in the CRYPTREC Ciphers List.

NIST IR 8547: the draft 2030 and 2035 transition schedule

On 12 November 2024, NIST published NIST IR 8547, “Transition to Post-Quantum Cryptography Standards”, as an initial public draft (ipd) setting out its approach to moving from quantum-vulnerable algorithms to PQC. The comment period closed on 10 January 2025, and the comments received were published on 21 January 2025. As of 13 October 2026, the initial public draft is the only version on NIST’s Computer Security Resource Center (CSRC); no final version has been published.

“Deprecated” means the algorithm may still be used but carries some risk, and the data owner decides whether to keep using it; “disallowed” means it is no longer allowed for the stated purpose. The draft cites National Security Memorandum 10 (NSM-10), which sets 2035 as the primary target for completing the migration of US federal systems to PQC, and notes that some systems, such as those with long-term confidentiality needs, may need to move earlier. It also says that, to mitigate harvest-now-decrypt-later attacks on network communications, application-specific guidance may require or recommend migration to quantum-resistant key establishment before the classical schemes are generally disallowed.

The FSA study group report (November 2024): key points

The FSA held three meetings of its Study Group on Post-Quantum Cryptography for Deposit-Taking Financial Institutions between July and October 2024 and published the report on 26 November 2024. Members included representatives of the three megabanks and of industry associations of deposit-taking institutions, as well as cryptography experts; Financial ISAC Japan, the CRYPTREC secretariat, FISC, the Bank of Japan’s Financial System and Bank Examination Department and the National center of Incident readiness and Strategy for Cybersecurity (NISC) took part as observers. The report notes that the study group was a forum for exchanging views on administrative matters, not a statutory council.

The timeline: the mid-2030s

The executive summary says that high-priority systems in each organisation should be able to use PQC algorithms by around the mid-2030s, while watching technical progress and regulation abroad. The recommendations in the body give “the early to mid-2030s” as the benchmark and say the deadline is not fixed but should be reviewed flexibly as laws, regulations and CRQC development evolve. The report also suggests treating a failure to migrate high-priority systems by the deadline as a contingency and preparing alternatives, such as protecting communications with pre-shared keys (noting that very few environments can use this), a policy that keeps the use of encrypted communications to the minimum necessary, and keeping physical originals of especially important signed documents in secure storage.

Which systems to prioritise

The report says the basic approach is to start with systems that are important, quantum-vulnerable and relatively likely to be exploited, and gives as an example prioritising those that meet all three conditions. It also names two uses needing long-term protection where early action may be warranted: code signing for the firmware of hardware that cannot easily be replaced, and key exchange in TLS. Because TLS may carry information with long and short retention periods mixed together and process it all in the same way, the report recommends prioritising TLS key exchange.

The role of senior management

The report treats PQC as a major risk management issue and says senior management should lead it as a company-wide initiative, understand how cryptography is used in each system, how important the data is and how long it is kept, and then decide the migration policy. Japanese financial institutions depend heavily on outsourcees for development and operations, yet vendors’ readiness varies, so the report asks institutions not to rely entirely on their vendors but to take ownership themselves. Internally, it calls for clear roles and responsibilities across business, cybersecurity, IT, risk management, internal audit and public relations functions, and suggests securing resources, including outside partners, where cryptography specialists are scarce.

The FSA’s 2025 request: do not postpone preparation

Since publishing the report, the FSA has also pressed financial institutions to begin migration at its exchanges of views with them. In its notes for a meeting with banks with new business models on 6 June 2025, it pointed out that if quantum computers were misused, the cryptography used in internet banking and similar services could be broken, compromising the confidentiality of customer information. Noting that large system renewals usually happen only once every few years, so the opportunities for PQC migration are limited, the FSA said it is inappropriate to treat this as a distant problem and put off preparation, and asked institutions to start immediately.

• Roadmap: draw up a roadmap now, in consultation with IT vendors, covering everything from the start of the study to the completion of migration. Financial ISAC Japan is working on a roadmap template, but institutions should not wait for it and should start on what they can do themselves.
• Inventory and risk assessment: build a comprehensive picture of information assets and an inventory listing the cryptography each one uses. Assess the risk of compromise once quantum computers arrive and the risks that call for action now against HNDL attacks, and evaluate importance and urgency.
• Follow-up: the FSA will work with Financial ISAC Japan and industry associations, using inspections and monitoring among other tools, to promote and follow up the PQC migration of each institution and of the industry as a whole.

How the 14th edition of the FISC Security Guidelines fits in

The 14th edition of the FISC Security Guidelines on Computer Systems for Financial Institutions, issued in March 2026, lists post-quantum cryptography among its revision areas and says it reflects “the points to note on PQC migration and the response timeline” and other content of the FSA study group report. FISC’s public pages do not show which items changed or how, so check the specifics in the purchased edition. Since the report itself cites FISC’s “specified systems” as an example of a prioritisation criterion, it helps to manage the PQC items in the FISC mapping table and link the cryptographic inventory and migration plan to them as evidence; that makes the position easier to explain to inspectors and internal auditors.

Government and G7 timelines: 2035 as the common end point

The Japanese government held the first meeting of its inter-ministerial liaison conference on the use of post-quantum cryptography in government agencies on 30 June 2025 and published an interim report in November 2025. Noting that the US, the EU, the UK, Canada and many other countries are migrating with 2035 as the deadline, the interim report says government agencies will in principle aim to complete migration to PQC by 2035, and that a roadmap will be drawn up in fiscal 2026. Although it covers government agencies, it says PQC migration is also an issue for critical infrastructure operators and private businesses, and that the government will support a smooth transition. Finance is one of the critical infrastructure sectors defined in the government’s action plan.

The G7 Cyber Expert Group (CEG), which advises G7 finance ministers and central bank governors, published its Statement on Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector on 12 January 2026, and the FSA has posted a provisional Japanese translation. The statement says it does not set guidance or regulatory expectations. It notes that current guidance often points to 2035 as an overall target, and says that prioritising the most critical systems, for example by addressing them in 2030 to 2032, will limit the downside if the risks materialise early. It groups migration activities into six phases (awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring), while stressing that many activities run in parallel and are revisited.

Crypto-agility and hybrid schemes

Crypto-agility is the property of a system that lets it move from one cryptographic scheme to another smoothly and with minimal disruption. PQC is relatively new, and the FSA report points to SIKE, a candidate that reached the fourth round of NIST’s standardization process and was then broken. It therefore recommends planning not for a single move from quantum-vulnerable cryptography to PQC but for several migrations. The report gives the following practical methods.

• Abstract cryptographic calls: have the main routine of an application call only abstracted cryptographic functions, and keep the processing for specific algorithms and parameters separate.
• Choose standards-based products: adopt products that let you select standardized PQC algorithms and parameters, or that implement standardized protocol specifications.
• Keep validity periods short: set relatively short validity periods for items distributed to third parties, such as digital certificates and IC cards.
• Upgrade protocols: upgrade protocols and versions that may never support PQC; the report cites moving from TLS 1.2 to TLS 1.3 as an example.
• Manage certificates and keys centrally: make more use of management platforms that handle the life cycle of digital certificates centrally and renew them automatically.

A hybrid scheme combines existing cryptography and PQC in a single cryptographic function, aiming to stay secure even if one of the two is broken; it is mainly used during the transition to full migration. The report warns that custom implementations risk making the whole only as secure as its weakest scheme, and recommends following standardized or in-progress schemes, such as the IKEv2 hybrid method published as RFC 9370. On performance, PQC uses more resources than existing public-key cryptography in at least one of key size, signature size and computation, which raises issues with carrying TLS server certificates and with the number of connections a single web server can handle at once. During the transition, institutions also need to plan for a mix of counterparties that do and do not support PQC, and for functions that can serve both.

Where a financial institution should start: six steps

1. Involve senior management and set up the organisation: report PQC migration to senior management as a risk management issue, and decide the migration policy, the accountable executive and the roles of the functions involved (IT, cybersecurity, risk management, internal audit, business lines and others). Record each decision and its rationale in minutes or approval records.
2. Build a cryptographic inventory: covering both in-house systems and systems and products supplied from outside, and starting with high-priority systems, list where cryptography is used, for what purpose, which algorithms and key lengths, and how keys are managed. If you already keep an IT asset register, one approach is to add fields for the algorithms in use and the algorithms available.
3. Prioritise: rank systems by how long their data must stay protected, how important the business is, their exposure to the internet and external systems, and whether defence in depth is in place. Assess early the uses most exposed to HNDL attacks, such as TLS key exchange, and firmware signatures on equipment that stays in service for a long time.
4. Build crypto-agility into the migration plan: align PQC migration and crypto-agility with large system renewals and upgrades, and set deadlines starting with the highest priorities. Include fallback measures in case a deadline is missed.
5. Ask vendors and cloud providers: ask development vendors, product vendors and cloud providers for their PQC roadmaps, and consider making support dates a condition when signing or renewing contracts.
6. Record and review regularly: update the inventory at every system renewal, and review the plan as standards, regulation and CRQC development evolve. Record risk-acceptance decisions together with the reasons.

What to record in a cryptographic inventory

To collect the information, the report suggests interviewing system owners, interviewing development and product vendors, discovery with network scanning tools, and analysis of application code, and stresses that the inventory is not a one-off exercise: it must be updated regularly and whenever a system is renewed. The CISA, NSA and NIST factsheet notes that discovery tools may not find cryptography embedded inside products, so organisations should ask vendors for lists of the cryptography embedded in their products. For the format, the FSA report says the format defined in CycloneDX v1.6, adopted as an Ecma international standard, is also a useful option.

What to ask vendors and cloud providers

• PQC migration roadmap: when PQC algorithms will be tested and integrated into products. CISA, NSA and NIST say vendors should ideally publish their own PQC roadmaps.
• Embedded cryptography: the algorithms and key lengths used inside the product or service.
• Method and cost: whether new products will ship with PQC built in, when and through which updates existing products will support PQC, and what the migration is expected to cost.
• Enabling PQC in the cloud: whether using PQC in a cloud service requires configuration changes or application updates.
• The vendor’s own preparation: top management involvement, a cryptographic inventory, and a policy for prioritising migration. The FSA report says the sample questions FS-ISAC provides on these points can be used in actual vendor interviews.